37299afa1d46a1aa02b7b06a39d41d876f454047527e406e7cbcb659833de728

Analysis

Target
UPDATED S.O.A..exe
Size 796KB
Sample200708-v6hnslypfe
SHA256 37299afa1d46a1aa02b7b06a39d41d876f454047527e406e7cbcb659833de728
MD5 37abe07d477f8fd134cd1c4f7bde592d
SHA1 12f091feb8be7dc754ee73090c8bbcce5d82c4d3
SHA512 34ba619d7ebd7ffd77cad9445c05f5447a69e3984d2111f88829db3413427b41d68bb7464440ef2cf750830763a2cd088ef22e04bb68b1d2cf1a3782eaaacf03
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3964	2600	WerFault.exe	66

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious behavior: EnumeratesProcesses 13 IoCs

C:\Users\Admin\AppData\Local\Temp\UPDATED S.O.A..exe
"C:\Users\Admin\AppData\Local\Temp\UPDATED S.O.A..exe"
1⤵
PID:2600
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2600 -s 1144
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  PID:3964

memory/3964-0-0x0000000004940000-0x0000000004941000-memory.dmp

Download

memory/3964-1-0x0000000005100000-0x0000000005101000-memory.dmp

Download